Security
Security is a first-class part of how Pandora Modules is built, not an afterthought. This page summarizes the controls in place today. It reflects our current practices and is not a certification; we are happy to discuss specifics with prospective customers under NDA.
Tenant isolation
Pandora Modules is multi-tenant, and isolation is enforced by the database, not
only by application code. Every tenant-owned table carries a tenant identifier and is protected by
PostgreSQL row-level security (RLS) in fail-closed FORCE mode, so a
query can only ever see the current tenant's rows. The application connects using a dedicated,
non-owning database role that cannot bypass RLS — meaning even a bug in application code
cannot read across tenant boundaries. This is applied across the platform (currently 260+ protected
tables) and is covered by an automated cross-tenant isolation test suite.
Encryption
- In transit: all traffic is served over HTTPS/TLS.
- Credentials & secrets at rest: sensitive third-party credentials (for example integration tokens and mailbox passwords) are stored encrypted using authenticated symmetric encryption; they are never written in plaintext.
- Passwords: account passwords are stored only as salted one-way hashes.
Access control
- Role-based access control (RBAC) with per-user permission overrides, so tenant administrators grant only the access each user needs.
- A separate platform-operator class is used for our internal staff, distinct from tenant administrators; operator actions are audit-logged.
- Optional two-factor authentication on tenant accounts.
Application security
- CSRF protection on state-changing requests; secure, same-site session cookies.
- Output is escaped by default; user-supplied rich content is passed through a strict sanitization allowlist before rendering.
- New features go through a build process that includes automated tests and an independent, adversarial security review before release — a process that has caught and closed real issues prior to shipping.
Backups & recovery
- Automated nightly database backups, each validated for restorability as part of the backup run, with an off-box copy so a backup survives the loss of any single machine.
- We periodically perform test restores to verify backups actually recover — most recently confirmed with exact data parity.
- A documented disaster-recovery runbook defines the recovery procedure and objectives.
AI & data use
AI features only process the data you choose to expose to them, access is gated by the same tenant-entitlement and per-user permission checks as the rest of the platform, and every AI data read is audit-logged. Our AI API providers do not use your data to train their models. We do not sell customer data or use it for advertising.
Subprocessors & data processing
For business customers, our Data Processing Addendum sets out how we process personal data on your behalf and lists the subprocessors we use to run the Service.
Reporting a vulnerability
If you believe you have found a security issue, please contact us via pandoramodules.com/contact with details and steps to reproduce. We appreciate responsible disclosure and will work with you to validate and remediate. Please do not access other tenants' data or run disruptive tests against the production Service.
Honest scope
We are an early-stage platform run on a hardened single-region deployment. We do not yet hold a formal certification (such as SOC 2) and do not yet offer point-in-time recovery or a contractual uptime SLA outside Enterprise agreements. We would rather tell you exactly where we are than overstate it — and we are glad to walk through our controls in detail.